Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
dnsmasq: Malicious DNS responses can hijack internet traffic
published 5 months ago
Summary
A software update is available to fix several security weaknesses in dnsmasq, a tool used to manage DNS and DHCP settings. If left unpatched, attackers could potentially redirect users to malicious websites, disrupt internet services, or even gain unauthorized access to a network. It is recommended to update dnsmasq to the latest version as soon as possible.
What to do
- Update mageia dnsmasq to version 2.92rel2-1.mga9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Mageia:9 | mageia | dnsmasq |
< 2.92rel2-1.mga9 Fix: upgrade to 2.92rel2-1.mga9
|
Original advisory text
Updated dnsmasq packages fix security vulnerabilities
CVE-2026-2291: dnsmasqs extract_name() function can be abused to cause a
heap buffer overflow, allowing an attacker to inject false DNS cache
entries, which could result in DNS lookups to redirect to an
attacker-controlled IP address, or to cause a DoS.
CVE-2026-4890: A Denial of Service (DoS) vulnerability in the
DNSSEC validation of dnsmasq allows remote attackers to cause a denial
of service via a crafted DNS packet.
CVE-2026-4891: A heap-based out-of-bounds read vulnerability in
the DNSSEC validation of dnsmasq allows remote attackers to cause a
denial of service via a crafted DNS packet.
CVE-2026-4892: A heap-based out-of-bounds write vulnerability in
the DHCPv6 implementation of dnsmasq allows local attackers to execute
arbitrary code with root privileges via a crafted DHCPv6 packet.
CVE-2026-4893: An information disclosure vulnerability in
dnsmasq allows remote attackers to bypass source checks via a crafted
DNS packet with RFC 7871 client subnet information.
CVE-2026-5172: A buffer overflow in dnsmasq’s
extract_addresses() function allows an attacker to trigger a heap
out-of-bounds read and crash by exploiting a malformed DNS response,
enabling extract_name() to advance the pointer past the record’s end.
heap buffer overflow, allowing an attacker to inject false DNS cache
entries, which could result in DNS lookups to redirect to an
attacker-controlled IP address, or to cause a DoS.
CVE-2026-4890: A Denial of Service (DoS) vulnerability in the
DNSSEC validation of dnsmasq allows remote attackers to cause a denial
of service via a crafted DNS packet.
CVE-2026-4891: A heap-based out-of-bounds read vulnerability in
the DNSSEC validation of dnsmasq allows remote attackers to cause a
denial of service via a crafted DNS packet.
CVE-2026-4892: A heap-based out-of-bounds write vulnerability in
the DHCPv6 implementation of dnsmasq allows local attackers to execute
arbitrary code with root privileges via a crafted DHCPv6 packet.
CVE-2026-4893: An information disclosure vulnerability in
dnsmasq allows remote attackers to bypass source checks via a crafted
DNS packet with RFC 7871 client subnet information.
CVE-2026-5172: A buffer overflow in dnsmasq’s
extract_addresses() function allows an attacker to trigger a heap
out-of-bounds read and crash by exploiting a malformed DNS response,
enabling extract_name() to advance the pointer past the record’s end.
References
- https://advisories.mageia.org/MGASA-2026-0135.html Vendor Advisory
- https://bugs.mageia.org/show_bug.cgi?id=35520 Third Party Advisory
- https://thekelleys.org.uk/dnsmasq/CHANGELOG URL
Timeline
Published14 May 2026
Updated14 May 2026
First seen14 May 2026
Sources
MGASA-2026-0135 · OSV
Track software like this
Free during beta